Privacy Policy

1. Introduction

This Privacy Policy applies to information processed by MOS in its own capacity as a business with respect to visitors, prospective clients, business contacts, authorized users, and other individuals interacting with the Services.

Certain information MOS processes on behalf of healthcare providers or other organizations may be subject to separate agreements, including BAAs, service agreements, and applicable healthcare privacy laws. Where MOS processes PHI as a business associate of a HIPAA-covered entity, its processing is governed by the applicable BAA, HIPAA, HITECH, applicable implementing regulations, and other applicable law. If this Policy conflicts with an applicable BAA with respect to PHI, the BAA and applicable law govern to the extent of the conflict.

2. Scope

This Privacy Policy applies to information collected through or in connection with:

• medicalofficeservices.com and other MOS-controlled websites that link to this Policy
• MOS contact and inquiry forms, consultation requests, and Free AR Audit inquiries
• MOS client portals, administrative and staff portals, account registration, authentication, support requests, and authorized document-upload functionality
• electronic communications, website analytics and security technologies, marketing, business-development activities, and other online services expressly linking to this Policy

3. Important Notice Regarding PHI and Public Website Forms

The general public portions of the MOS website and ordinary website forms are not intended for transmission of PHI, medical records, patient information, Social Security numbers, financial-account credentials, or other highly sensitive information unless MOS expressly identifies a particular transmission method as appropriate.

Do not submit PHI through general contact forms, newsletter forms, ordinary marketing forms, public Free AR Audit inquiry forms unless expressly instructed otherwise, advertising or promotional forms, ordinary email addresses, website feedback forms, or any other channel not expressly designated for secure PHI transmission.

If you are an authorized representative of an MOS client and need to transmit PHI, use only the method expressly authorized by MOS and your organization. An encrypted connection, password-protected page, upload control, or other technical feature does not alone mean a channel is authorized for PHI.

4. MOS's Role Under HIPAA

MOS provides medical billing, coding, revenue-cycle-management, accounts-receivable, denial-management, consulting, and related administrative services to healthcare organizations. In connection with certain services, MOS may act as a business associate under HIPAA.

When MOS creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity in its capacity as a business associate, MOS uses and discloses that PHI only as permitted or required by the applicable BAA and applicable law. This Policy is not a HIPAA Notice of Privacy Practices for patients of MOS clients; individuals seeking information about a provider's privacy practices or medical records should generally contact that provider directly.

5. Information We May Collect

Depending on how you interact with MOS, we may collect contact and identity information, professional and business information, account and authentication information, client and portal information, communications, documents and files, and device, Internet, and usage information.

• Contact and identity information: name, business or practice name, professional title, business address, telephone number, email address, and other contact information.
• Professional and business information: specialty, practice type, organization, role, locations, provider information, billing or revenue-cycle needs, services of interest, and professional relationship information.
• Account and authentication information: account identifiers, username or email address, authentication status, multifactor-authentication information, role, organization affiliation, permissions, account status, session information, login timestamps, and security-related information. Passwords should be stored only through appropriately protected authentication mechanisms and not in readable plaintext.
• Client and portal information: organization, locations, providers, credentialing, administrative documents, contracts, invoices, support requests, activity, communications, workflow statuses, and other information necessary to provide contracted services.
• PHI: where permitted by an applicable BAA and necessary for contracted services, MOS may process PHI on behalf of covered entities. PHI is subject to HIPAA and applicable contractual restrictions.
• Device, Internet, and usage information: IP address, browser, operating system, device type, referring page, pages viewed, date and time, approximate IP-derived geography, session information, interactions, diagnostics, and security-related events.
• Cookies and similar technologies: essential website functionality, authentication, security, preferences, analytics, performance measurement, and understanding use of Services.

6. How We Collect Information

MOS may collect information directly from you; from your employer, practice, organization, another authorized user, or MOS clients; automatically through use of the Services; from vendors and service providers; from publicly available professional or business sources; through contractual relationships; and from other sources permitted by law.

7. Purposes for Which We Use Information

MOS may process information as reasonably necessary to provide and administer Services; perform contracted billing and revenue-cycle services; establish client relationships; create and administer user accounts; authenticate users; enforce access controls; provide support; communicate with clients and prospective clients; respond to inquiries; evaluate service and AR-audit requests; process documents; support credentialing; administer invoices; maintain records; protect systems; prevent fraud and unauthorized access; maintain audit records; troubleshoot; analyze performance; improve Services; comply with law and contracts; and establish, exercise, or defend legal rights.

8. How We May Disclose Information

MOS may disclose information as reasonably necessary to authorized MOS personnel with a legitimate business need; appropriately authorized representatives of a client organization; service providers and subcontractors supporting hosting, cloud infrastructure, authentication, communications, storage, security, monitoring, analytics, document management, and professional services; and for legal, regulatory, security, or corporate-transaction purposes.

Where a vendor or subcontractor creates, receives, maintains, or transmits PHI on behalf of MOS and HIPAA requires a BAA, MOS will address the relationship as required by applicable law. Any corporate transfer of PHI remains subject to applicable HIPAA and contractual requirements.

9. Sale and Sharing of Personal Information

MOS does not intend its medical billing or revenue-cycle operations to constitute the sale of PHI, and PHI will be used or disclosed only as permitted by applicable law and applicable BAAs. If MOS engages in activities constituting selling or sharing personal information under applicable California law, this Policy and the website will be updated with legally required disclosures and opt-out mechanisms.

10. Data Security and Security Incidents

MOS maintains administrative, physical, and technical safeguards designed to protect information appropriate to its nature and applicable legal and contractual requirements. For ePHI, applicable safeguards are governed by the HIPAA Security Rule, applicable BAAs, and MOS security policies. Measures may include access controls, authentication, role-based permissions, least-privilege principles, encryption, audit logging, monitoring, secure configuration, workforce policies, awareness, incident response, vendor management, and other reasonable safeguards.

No system, transmission, or storage environment can be guaranteed completely secure. MOS maintains processes for evaluating suspected security incidents and will address notification requirements triggered by HIPAA, HITECH, California law, an applicable BAA, or other law in accordance with those authorities.

11. User Responsibilities for Sensitive Information

Users of MOS systems are responsible for using only accounts assigned to them, maintaining credential confidentiality, complying with organizational security policies, using approved transmission methods, accessing only authorized information, not circumventing security controls, promptly reporting suspected compromise, ensuring submitted information is lawfully obtained and disclosed, and refraining from submitting PHI through public or unauthorized channels.

12. Data Minimization and Retention

MOS seeks to collect and retain information reasonably necessary for legitimate business, contractual, security, regulatory, and legal purposes. Users should not provide information MOS has not requested or that is unnecessary for the relevant transaction.

MOS retains information for periods reasonably necessary to provide Services, perform contractual obligations, maintain records, meet legal and regulatory requirements, address disputes, enforce agreements, preserve security and audit records, and fulfill other legitimate purposes. PHI may be retained or returned/destroyed in accordance with applicable BAAs, HIPAA, contractual obligations, and other requirements.

13. California Privacy Rights

California residents may have rights under applicable California privacy laws. Depending on whether a law applies to MOS and the information at issue, those rights may include rights to know or access certain personal information, obtain information concerning categories and sources, request deletion or correction, opt out of certain sales or sharing, limit certain uses or disclosures of sensitive personal information, and receive equal service and pricing without unlawful discrimination.

Not every California privacy statute applies to every business or category of information, and certain information may be exempt from particular requirements, including information governed by HIPAA or another statutory exemption. MOS will honor applicable rights when required by law.

14. California Privacy Requests and Shine the Light

MOS may need to verify a requester's identity and authority before completing a privacy request. Authorized agents may submit requests where permitted by law, subject to appropriate verification. MOS may deny or limit a request where permitted or required by law and will provide an explanation where legally required.

To the extent California Civil Code section 1798.83 applies to MOS, California residents may request information concerning certain disclosures of personal information to third parties for their own direct-marketing purposes using the privacy contact information below.

15. Do Not Track, Preference Signals, and Analytics

Browser-based Do Not Track signals have not historically been governed by a uniform industry standard. MOS will describe its response to such signals as required by applicable law. Where legally required and technically applicable, MOS will recognize legally recognized opt-out preference signals, such as Global Privacy Control, with respect to activities covered by those requirements.

MOS may use analytics, performance, security, or similar technologies to understand and protect the Services. MOS does not authorize third-party advertising or analytics technologies to receive PHI through authenticated portal areas unless that processing has been specifically reviewed, authorized, and contractually addressed as required by law.

16. Email and Electronic Communications

Ordinary email may not be appropriate for transmitting PHI or other highly sensitive information. Unless MOS expressly instructs otherwise, do not send PHI, medical records, patient information, passwords, financial-account credentials, or similarly sensitive information through ordinary email. MOS may send transactional communications related to accounts, security, Services, or business relationships.

17. Children's Privacy and International Visitors

The Services are intended for healthcare professionals, medical practices, business representatives, and other adults engaged in professional or business activities. They are not directed to children under 13, and MOS does not knowingly solicit personal information directly from children through the public website.

MOS is a United States business headquartered and operated in California and primarily provides services in the United States. Information submitted to MOS may be processed and stored in the United States, subject to applicable law. Mere accessibility of the website from the EEA or UK should not be interpreted as an intentional offer of Services in those jurisdictions.

18. Third-Party Websites and Changes to This Policy

The Services may contain links to websites or services operated by third parties. MOS does not control the privacy, security, availability, or content of independent third-party services. Users should review their policies before providing information.

MOS may revise this Privacy Policy to reflect changes in law, technology, security practices, Services, business operations, or data-processing practices. The Last Updated date indicates the most recent revision. Where required by law, MOS will provide additional notice or obtain consent before a material change becomes effective.

19. No Modification of Business Associate Agreements

This Privacy Policy is a general public-facing privacy statement. It does not amend, supersede, replace, or expand any BAA, service agreement, confidentiality agreement, data-processing agreement, or other written contract between MOS and a client. With respect to PHI processed by MOS as a business associate, the applicable BAA and applicable law govern.